Azure Virtual Machines
An Azure service that is used to provision Windows and Linux virtual machines.
7,081 questions
How to check the logs of registry change from event viewer
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(9.6, 77%, 10%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Azure
0
Reputation points
I was unable to RDP to azure vm and getting RDP 3 line error
When I ran rdpsettings from Run command in azure portal found the registry value of "fdenytsconnections" as 1 and it needs to be 0. Changed value to 0 and able to RDP now.
I need to know who changed the registry value. When I googled it 4657 is the event id for registry modification. When I checked it in security logs, did not find any logs.
Please help me finding who made the change.
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(118.4, 98%, 21%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EKM%3C/text%3E%3C/svg%3E)
KarishmaTiwari-MSFT 18,352 Reputation points Microsoft Employee2023-05-17T18:08:14.06+00:00 @Azure Thanks for posting your query on Microsoft Q&A.
I'm sorry to hear that you are facing this issue. Based on the information you provided, it seems that you are trying to find out who changed the registry value of "fdenytsconnections" from 0 to 1.
Can you please confirm if you were able to check the event logs by using the Windows Event Viewer? It can help with finding out who made the change to the registry value.
If you have already done that and are unable to find any logs related to the registry change, it is possible that the security logs have been cleared/overwritten or the auditing of registry changes was not enabled at the time of the modification. Therefore, it may not be possible to determine who made the change. In such cases, it is recommended to review the access controls on the affected registry key to prevent unauthorized changes in the future.
As you mentioned, event ID 4657 is the event ID for registry modification. To enable auditing of registry changes, you can follow the steps mentioned in this Microsoft article. Once auditing is enabled, you can check the security logs for event ID 4657 to determine who made the change.
I hope this helps. Let me know if you have any further questions.
-
KarishmaTiwari-MSFT 18,352 Reputation points Microsoft Employee
2023-05-23T00:07:28.99+00:00 @Azure Just checking in to see if the above comment helped. If you have any further query do let us know.
Sign in to comment